Git Security 2025
ListedHelps with Git, security as part of implementing security and authentication workflows.
Install on your platform
Showing Claude Code. One command installs this skill into any of the agents below.
- 1
Run this in your project
terminal$ npx skills add josiahsiegel/claude-plugin-marketplace --skill git-security-2025 -a claude-code Uses the open-source
skillsCLI and needs Node.js. Add-gto install it for your user instead of this project.
What we know about this skill
Publisher
josiahsiegel
Taken from the source listing. We haven't verified who controls this account.
Install target
Live repository
Not pinned. Installing fetches whatever the repository holds at the time you run the command.
Automated safety checks
This skill failed 1 of 6 checks. A failure is not proof of bad intent; it means something in the code needs a human to look at it before you run it.
No credential access: failed
Touches credential material in 13 places.
Neither the code nor the SKILL.md instructions read SSH keys, cloud credentials, keychains, token stores, browser cookie databases or dotfiles that hold secrets.
What it found (3 of 13)
- plugins/git-master/skills/git-security-2025/SKILL.md:185GnuPG private keyring
echo 'default-cache-ttl 34560000' >> ~/.gnupg/gpg-agent.conf - plugins/git-master/skills/git-security-2025/SKILL.md:186GnuPG private keyring
echo 'max-cache-ttl 34560000' >> ~/.gnupg/gpg-agent.conf - plugins/git-master/skills/git-security-2025/SKILL.md:201SSH private keys or config
ls -la ~/.ssh/id_ed25519.pub
Declares what it does: passed
SKILL.md parses and declares a name and a description.
SKILL.md exists, its frontmatter parses, and it declares a name and a description.
No undeclared network calls: passed
Only contacts known or declared hosts: github.com.
Every host the skill dials — from its scripts, its config endpoints or the commands it tells the agent to run — is either well-known package and API infrastructure or declared in its own frontmatter. Links in documentation are not counted.
Hosts contacted
github.comsource hostNo obfuscated payloads: passed
No encoded or obfuscated payloads.
No base64, hex or compressed blob is decoded and then executed, and no encoded shell commands.
No pipe-to-shell installers: passed
No pipe-to-shell or download-and-run installers.
No `curl … | sh` pattern, in the code or in the instructions, that runs code fetched at run time.
Pinned to a commit: passed
Scanned josiahsiegel/claude-plugin-marketplace at 5a1b1123b9.
The exact upstream commit SHA that was scanned is recorded, so the result refers to specific bytes.
- Commit
- 5a1b1123b9
- Scanned
- 2 files, 654 lines
About this skill
What it does
This skill provides guidance and tools for implementing Git security best practices aligned with a Zero-Trust model expected to be standard in 2025. It focuses on ensuring developer identity verification, enforcing signed commits, enabling continuous audit logging, restricting access based on the principle of least privilege, and establishing continuous monitoring workflows within Git repositories. The skill also includes specific instructions for handling file paths correctly when using editing or writing tools on Windows systems.
When to use it
- When implementing a Zero-Trust security model for your Git repositories.
- To enforce mandatory signed commits across your development team.
- For setting up continuous audit logging of Git operations.
- To restrict direct push access and implement code review requirements on branches.
- When needing to ensure correct file path formatting (using backslashes) when interacting with files in a Git repository using editing or writing tools on Windows.
Key capabilities
- Zero-Trust Implementation: Guidance on implementing Zero-Trust principles for Git repositories, including authentication, authorization, logging, signing, and monitoring.
- Signed Commits Enforcement: Instructions for configuring mandatory signed commits globally and through branch protection rules in platforms like GitHub/GitLab/Azure DevOps.
- Identity Verification: Methods to verify developer identity with each commit using
git log --show-signature. - Audit Logging: Configuration of Git audit trails and exporting logs for monitoring suspicious activity.
- Least Privilege Access: Example branch protection rules demonstrating how to restrict direct push access and require code owner reviews.
- Windows File Path Handling: Mandatory guidance on using backslashes (\) in file paths when editing or writing files within Git repositories on Windows systems, avoiding forward slashes (/).
- Documentation Guidelines: Instructions for maintaining repository cleanliness and adhering to professional documentation style.
Example prompts
- "How do I enforce signed commits on the 'main' branch?"
- "Show me an example of a security monitoring workflow."
- "What is the correct way to specify a file path when writing to a file in Git on Windows?"
- “Generate a git audit log.”
Tips & gotchas
- Windows File Paths: Remember that all file paths used with editing or writing tools must use backslashes (\) on Windows. Using forward slashes will result in errors.
- Documentation: Prioritize updating existing README files over creating new ones unless explicitly requested.
- Branch Protection: Branch protection rules are crucial for enforcing many of the Zero-Trust principles, particularly signed commits and code review requirements.